Forget OAuth complexity.

OAuth.popup('facebook').then((facebook) => {
    return facebook.me()
}).then((me) => {
    console.log('Your name is ' + me.name)
}).catch((error) => {
    console.error(error)
})

User.signin(email, password).done((user) => {
    console.log(user.data.firstname);
}).fail((err) => {
    // email/password incorrect.
});

app.get('/me', OAuthProvider.OAuth2.check(), (req, res, next) => {
    let user = req.session.user,
        response

    delete user.password
    if (req.OAuth2.scope['user_info']) {
        response = user
    }
    else {
        response = {
            error: 'Access not permitted by user'
        }
    }
    res.send(response)
});